[Pedro Henrique Penna (ppenna)]

Leaving code only. This PR changes only code that this effort removes from NVX: the old clone path (host::template::clone: its records, planning, launch, restore sequence and store-based reattach), with the crate-private code that only it used and the edits that remove references to it. Nothing that stays changes, and no later PR uses what it changes, so the size limits for kept code don't apply.

Outside the clone path and the stores that SL6.2a and SL6.1 delete, the modules that it edits, host::platform, host::seal, host::snapshot and host::sandbox, only lose the crate-private items that only the clone path used, as the compiler's dead-code check finds them, with the rustdoc and test assertions that named them.

Part of #1121 (SL6.2b, "The old clone path is gone"). Parent #1087, umbrella #1076.

What and why

Since #1499 (SL5.2) deleted the runtime adapter, nothing calls the old clone path, which restored a clone from a template store's leased generation. This PR does SL6.2b's Scope and no more, in one commit, host: delete the old clone path:

• The old clone path goes: nvx-rs/src/host/template/clone.rs and clone/, 14 files and 15,666 lines.

  • Planning: ClonePlan, CloneRequest and CloneUpper, with the export check (export.rs).
  • The old clone launch, ClonePlan::launch, which returned a Restoring (launch.rs).
  • The restore sequence (restore.rs): CloneControl, Activated, Started, RestoreDeadlines, MAX_ACTIVATION_SESSIONS, RESTORE_TO_READY_TIMEOUT, READY_TO_START_TIMEOUT and RESTORE_READY_EVENT.
  • The failure and clone records (failure.rs, record.rs, records.rs): CloneFailure, Evidence, Outcome, Stage, Progress, Teardown, FailureRecord, CloneRecords, FAILURE_FORMAT and status_evidence, with the backward scan of OpenVMM's log for its fatal line.
  • Store-based reattach (reattach.rs): reattach_clone and ReattachedClone.
  • Their tests: template/clone/tests.rs, template/clone/tests/{launch,restore}.rs and template/clone/{failure,launch,records}/tests.rs (the last only held a test hook).

  host::template loses mod clone, its re-export, and the five bullets of its rustdoc that described it. The public API snapshots lose its 194 items on each platform, all under nvx::host::template.

• The crate-private code that only the clone path used goes with it, item by item in the table below: once the clone path goes, CI's warning-denied builds (cargo clippy -- -D warnings of each feature set, with the test builds, on Linux and on Windows) refuse each of them as unused, and nvx-rs slimming, phase 4.2: the old code is deleted, consumers first #1087 asks each deletion to remove the crate-private code that it leaves unused, as the compiler finds it. What supervisor::launch returns and leaves doesn't change: it already passed a hook that records nothing, and kept only LaunchFailure::error.

• What stays, as the Scope says: the stores' identity types and the host::template aliases that the template store still uses, for SL6.2a and SL6.1.

• The docs stop naming the clone path, with no other change:

  • rustdoc: host::template's module docs; host::supervisor's "Clones" section, whose steps 2 and 3 launch the clone with launch, after the caller bound what its restore needs, such as its restore-ready endpoint, check through the caller's own transport that its restore completed, and only then commit the launch, or abandon it, without the deleted plan and restore sequence, and whose crash notes drop reattach_clone; Vmm::stop_unless_exited, launch_reporting, abandon_after and Starting::commit_reporting; the sandbox store's CLONE_ACTIVATION_NAME, RESTORE_READY_NAME, CLONE_PROGRESS_NAME and CLONE_FAILURE_NAME, which no longer say what the deleted launch wrote in them; the geometries of the distro and scratch bindings; each platform's restore-ready listener, which host::restore now uses alone; the template store's clone socket, whose length only the deleted launch checked; and the mentions of is_refused.
  • nvx-rs/README.md: the module table's row of nvx::host::template (now "Legacy template capture plans and store, with aliases of the snapshot metadata"); its section, which loses the paragraphs of the clone plan, launch, restore sequence, failures, reattach and records, and keeps those of the store, of which the lease's clone socket no longer names the deleted launch's checks; the supervisor's Windows working-directory limit, which no clone preflight checks now; and "Checked handoff", which loses its paragraph on the clone.
  • doc/acceptance-case-matrix.md: the doc test of ClonePlan is retired, and the template store's doc test follows its code to line 473 (was 474), and its two doc tests, of TemplatePlan and Store, now name SL6.2a, which deletes the template store, as the PR that retires them; the Docs row now counts 36 tests, 34 kept, 1 rewritten, 1 retired.
  • doc/modules, the module diagrams, still show host::template::clone: CI's nightly module-diagrams workflow draws them again, as doc/ci.md asks.

The crate-private code that the deletion leaves unused

Each item had no user but the clone path. The finding is what CI's warning-denied build reports once the clone path goes, as the Windows build reported it, or the Linux build for Linux's receive; the cross-platform items have no other user on Linux either, where both builds pass without them. An import or a parameter that only a deleted item used goes in the same step, as the next finding. The tests that named an item change with it, as Changes to existing tests explains.

Item	What the clone path used it for	The compiler's finding without the clone path	Tests
host::platform::is_refused, with its re-export in host::store::regular	ClonePlan::new attributed a failed read of the leased generation's key or snapshot to the generation when the read refused the file for what it is (a link, not a regular file, or longer than its bound), and to the host otherwise (clone.rs, generation_fault)	function is_refused is never used, unused import: is_refused	three drop their assertions on it: host::platform::tests::a_bounded_read_refuses_a_regular_file_that_holds_more_than_its_bound, host::platform::tests::an_open_of_a_regular_file_refuses_a_link_and_a_directory, host::store::tests::entries_that_are_links_or_not_regular_files_are_refused_as_the_platform_refuses_them
host::platform::link_count on Linux, Windows and other hosts, with its re-exports	ClonePlan::new refused a scratch image with more than one name (clone.rs, check_single_name)	function link_count is never used, unused import: link_count; the other hosts' stub goes with them	none
Windows' host::platform::listen_ready, with its re-export	ClonePlan::launch bound the restore-ready pipe at a name of its own (launch.rs); host::restore binds the pipe that its VM directory draws with ReadyListener::bind. Linux's listen_ready stays: host::restore uses it there	function listen_ready is never used, unused import: listen_ready (Windows)	host::platform::windows::tests::a_restore_ready_client_that_closed_before_its_connection_was_accepted_is_read_to_its_end binds its listener with ReadyListener::bind
Linux's unverified ReadyListener::receive in host::platform	the restore sequence read the restore-ready event of the clone's VMM (restore.rs); host::restore reads it through receive_verified	method receive is never used (Linux)	host::platform::linux::tests::a_restore_ready_client_that_closed_before_its_connection_was_accepted_is_read_to_its_end receives through receive_verified
host::seal::final_volume_path, with its Windows implementation and the VOLUME_NAME_GUID import	ClonePlan::new located a scratch image on Windows, to refuse one inside the template store, by the GUID of its volume when the volume had no drive letter or mount point (clone.rs, location_of)	function final_volume_path is never used (Windows, for both)	host::seal::windows::tests::final_volume_paths_name_the_file_by_its_volume, its own test, retires
host::snapshot::SnapshotKey::ipv6_gateway	a clone's activation record chose its DNS server with the IPv6 gateway of the template's NIC (record.rs)	method ipv6_gateway is never used	host::snapshot::key::tests::a_key_holds_what_its_capture_made drops its checks of it
host::sandbox::SandboxPlan::dns_server, with the IpAddr and Ipv6Addr imports	the same DNS server of a clone's activation record (record.rs)	method dns_server is never used, then unused imports: IpAddr and Ipv6Addr	none
DistroBinding::version and ScratchBinding::version in host::sandbox	ClonePlan::new attributed a binding of another version as stale (clone.rs)	method version is never used, for each	none
host::store::LockedStore::reserved_socket and LockedStore::owned_entries, with the is_report_staging, is_store_temporary and FILE_NAMES imports	ClonePlan::launch checked the length of the reserved control socket's path on Linux (launch.rs); ClonePlan::new refused an image or a scratch image that is a file of the sandbox's store (clone.rs, StoreFiles::of)	methods reserved_socket and owned_entries are never used, then unused imports	none
host::supervisor::Starting::end_keeping_journal	a failure of a clone that couldn't be recorded before its teardown ended the VMM and kept the launch's journal (records.rs)	method end_keeping_journal is never used	none
LaunchFailure::spawned and LaunchFailure::unended in host::supervisor, with abandon_after's spawned parameter, which only filled them	ClonePlan::launch told from them how a failed launch had ended (launch.rs)	fields spawned and unended are never read, then an unused spawned	host::supervisor::tests::a_launch_whose_caller_cannot_record_its_failure_keeps_its_journal_for_recovery drops its assertions on them
The pub(crate) re-exports of launch_reporting and reattach_reporting in host::supervisor	ClonePlan::launch and reattach_clone called them; the functions stay, for launch and reattach	unused import, for each	the test module of host::supervisor imports launch_reporting from super::launch
The re-export of SOCKET_PATH_LIMIT in host::template::store	ClonePlan::launch checked the length of its sockets' paths (launch.rs); the template store's capture still uses the constant	unused import: self::capture::SOCKET_PATH_LIMIT	none
Store::publish_spec_for_tests and the SNAPSHOT_ARTIFACTS re-export in host::template::store::tests	the clone tests (clone/tests.rs, clone/tests/launch.rs)	method publish_spec_for_tests is never used, unused import (test builds)	the template store's test module loses them

Every removed test, and its fate

python scripts/check_test_changes.py --base origin/feature/nvx-refactor reports 360 changes to existing tests: 121 removed tests, 7 modified tests, the imports of one test module, and the removed helpers, modules, imports and attributes of the deleted test files. All 121 removed tests retire, since what they check leaves NVX, and none is named in the case matrix, as coverage or otherwise (git grep of each name):

• the 120 unit tests of the clone path, below by file;
• host::seal::windows::tests::final_volume_paths_name_the_file_by_its_volume, the test of final_volume_path.

The doc test nvx-rs/src/host/template/clone.rs - host::template::clone::ClonePlan (line 247), which the report doesn't list, retires too, as the case matrix's Docs row says.

nvx-rs/src/host/seal/windows/tests.rs (host::seal::windows::tests): 1

final_volume_paths_name_the_file_by_its_volume

nvx-rs/src/host/template/clone/failure/tests.rs (host::template::clone::failure::tests): 10

each_row_of_the_table_attributes_its_evidence, names_are_those_of_the_records, a_repair_status_alone_is_evidence_of_the_repair_stage_at_any_point, an_activation_status_is_evidence_of_its_class_until_a_workload_may_have_run, a_report_gives_the_guest_s_status_and_its_evidence, a_status_prevails_over_what_was_seen_of_the_same_end_but_not_over_the_template_s_evidence, openvmm_s_fatal_error_is_evidence_of_an_incompatible_host_only_for_its_codes, openvmm_s_fatal_error_is_evidence_of_a_forward_bind_when_it_names_a_forward_it_cannot_bind, host_failures_that_ran_out_of_a_resource_are_resource_exhaustion, teardowns_follow_the_end_of_the_launch

nvx-rs/src/host/template/clone/records/tests.rs (host::template::clone::records::tests): 11

a_progress_log_records_each_step_once_with_the_steps_that_it_deferred, a_progress_log_replaces_an_earlier_one_only_in_the_directory_that_it_holds_open, a_progress_log_that_a_crash_cut_short_is_read_and_one_of_another_launch_is_refused, a_failure_record_is_read_as_it_was_written, a_failure_record_is_in_place_when_its_directory_is_synced, a_failure_record_keeps_the_ends_of_texts_too_long_for_a_read_to_take, a_failure_record_of_another_format_or_a_malformed_one_is_refused, a_failure_record_of_another_clone_than_the_one_of_the_lease_is_refused, the_line_of_openvmm_s_fatal_error_is_read_from_the_end_of_its_log, the_line_of_openvmm_s_fatal_error_is_read_before_a_chain_of_any_length, the_cause_that_names_a_forward_that_openvmm_cannot_bind_follows_the_fatal_line

nvx-rs/src/host/template/clone/tests.rs (host::template::clone::tests): 39

a_clone_in_ram_restores_its_lease_with_its_image_and_no_scratch_file, files_of_the_sandboxs_store_are_refused_as_images, links_and_directories_under_the_names_of_the_sandboxs_store_are_refused, a_scratch_image_that_is_a_file_of_a_generation_s_snapshot_is_refused, a_scratch_image_in_the_template_store_is_refused, locations_that_name_their_volume_by_its_guid_are_compared_with_the_store, a_scratch_image_with_another_name_is_refused, names_that_the_file_system_takes_for_those_of_the_stores_files_are_the_stores, templates_that_a_runtime_of_other_contracts_captured_are_refused, images_that_their_binding_does_not_authorize_and_malformed_generations_are_refused, keys_that_their_read_refuses_for_what_they_are_are_failures_of_the_template, keys_of_another_encoding_version_are_failures_of_the_host_that_quarantine_nothing, a_clone_on_a_scratch_image_claims_it_and_reads_no_content, a_scratch_image_serves_one_clone_at_a_time, scratch_images_whose_identity_or_kind_changed_are_refused, images_no_longer_than_the_placeholder_are_served_and_longer_ones_refused, scratch_images_of_another_length_or_geometry_are_refused, a_template_serves_clones_in_ram_whatever_geometry_its_scratch_presented, files_on_a_filesystem_of_another_block_size_are_refused, memory_targets_are_whole_blocks_from_the_templates_ram_to_its_capacity, processor_targets_are_counts_from_the_templates_processors_online_at_boot_to_its_capacity, requests_that_no_clone_takes_are_refused_before_anything_is_opened, templates_serve_the_networks_of_every_policy_at_their_nics_address_alone, clones_are_planned_under_the_lock_that_acquired_their_lease_before_their_launch, files_that_their_paths_do_not_name_as_checked_are_refused, the_activation_record_of_a_clone_in_ram_names_its_restore_image_and_settings, the_activation_record_of_a_clone_on_a_scratch_image_names_only_its_journal, the_activation_record_of_a_gpt_clone_names_its_disk_and_the_bound_of_its_first_partition, the_activation_record_of_a_clone_of_a_template_with_a_nic_names_its_own_network, settings_that_no_activation_record_holds_are_refused_before_anything_is_created, only_a_path_that_no_longer_names_its_supplied_file_is_the_request_s, a_clone_with_an_export_records_its_plan_and_maps_from_its_children, exports_that_no_cold_launch_attaches_are_refused_before_anything_is_opened, exports_that_overlap_the_template_store_are_refused_before_anything_is_opened, exports_that_let_the_guest_turn_the_template_store_s_path_are_refused, exports_that_let_the_guest_block_the_template_store_s_path_are_refused, exports_that_hold_the_sandbox_s_directory_are_refused, files_in_the_sandbox_s_directory_are_refused, the_export_of_a_clone_is_attached_and_mapped_as_a_cold_launch_attaches_and_maps_it

nvx-rs/src/host/template/clone/tests/launch.rs (host::template::clone::tests::launch): 43

restore_vmm_role, a_clone_restores_its_leased_snapshot_with_its_devices_and_activation_record, clones_of_one_generation_restore_its_snapshot_in_place_at_once, the_control_socket_of_a_clone_goes_once_its_vm_has_ended_and_for_good_with_its_lease, a_clone_of_a_template_with_a_nic_restores_its_own_policy_in_place_of_the_templates, a_clone_of_a_template_with_processors_offline_at_boot_restores_its_processor_target, a_clone_on_a_scratch_image_passes_its_claim_to_its_vmm, a_clone_with_an_export_binds_it_to_its_template_s_dormant_filesystem_slot, a_clone_whose_exported_objects_changed_since_its_plan_starts_nothing, a_clone_whose_export_cannot_be_inspected_starts_nothing_and_fails_with_the_host_s_evidence, a_clone_launches_only_as_the_launch_that_its_durable_binding_reserves, working_directory_limits_are_checked_before_clone_launches, a_clone_whose_launch_failed_before_it_began_launches_no_more_until_its_release, a_failure_that_a_reattach_records_before_any_launch_shows_no_report_of_an_earlier_vm, a_clone_whose_control_socket_openvmm_or_the_host_cannot_use_starts_nothing, launch_role, a_launch_whose_caller_crashes_before_it_begins_leaves_files_that_the_release_removes, a_launch_whose_caller_crashes_once_it_began_ends_as_reattach_recovers_it, a_launch_that_began_shows_the_report_of_a_vmm_that_its_journal_does_not_record, a_reattach_takes_the_report_of_a_vmm_whose_launch_a_recovery_of_the_sandbox_ended, a_launch_whose_caller_crashes_once_its_vmm_started_ends_the_vmm_as_reattach_recovers_it, a_restore_whose_caller_crashes_before_its_commit_ends_its_vmm_as_reattach_recovers_it, a_restore_whose_caller_crashes_once_it_committed_keeps_its_lease_while_its_vm_runs, a_clone_whose_caller_crashed_once_it_committed_is_taken_over_in_a_new_session, a_journal_that_a_clone_s_commit_left_is_no_failure_of_the_clone, a_reattach_ends_a_clone_that_it_may_not_keep_through_its_verified_identity, a_reattach_fails_a_clone_whose_record_of_a_failure_cannot_be_read, a_reattach_fails_a_clone_whose_sandbox_records_the_failure_of_another_clone, a_reattach_fails_a_clone_whose_record_of_a_failure_is_of_another_template, a_record_of_a_failure_that_cannot_be_read_is_a_failure_whatever_the_reattach_finds, a_reattach_ends_the_launch_of_a_caller_that_crashed_and_records_its_failure, a_reattach_records_the_failure_of_an_interrupted_launch_before_it_ends_the_launch, a_launch_abandoned_before_its_activation_leaves_the_spawn_for_a_reattach, a_clone_whose_vm_exited_once_it_committed_is_classified_by_its_report, a_reattach_records_the_failure_of_a_vm_that_exited_before_it_forgets_the_vm, a_reattach_takes_the_outcome_report_of_a_vm_that_exited_as_it_first_read_it, a_reattach_finishes_an_earlier_failure_with_what_the_clone_s_vmm_left_as_it_ended, a_clone_whose_progress_log_may_have_lost_its_steps_may_have_run_its_workload, a_clone_that_its_holder_stopped_ended_whatever_a_reboot_left_of_its_progress_log, a_clone_whose_vmm_exited_before_its_holder_s_stop_began_lost_its_status, an_interrupted_launch_that_a_reattach_cannot_end_yet_keeps_its_lease_until_one_can, a_reattach_that_cannot_record_a_failure_ends_and_forgets_nothing_of_the_clone, a_reattach_makes_the_record_of_an_earlier_failure_durable_before_it_ends_the_launch

nvx-rs/src/host/template/clone/tests/restore.rs (host::template::clone::tests::restore): 17

a_clone_is_activated_once_its_restore_is_ready_then_started_and_committed, a_ready_that_does_not_report_the_record_s_activation_ends_the_launch, a_session_that_the_adapter_lost_is_replaced_by_one_that_resends_the_same_record_first, a_retry_never_sends_another_record_nor_takes_another_activation, only_lost_sessions_are_replaced_and_only_so_many_times, a_clone_that_took_the_reset_of_a_lost_session_before_its_ready_ends_the_retries, the_restore_to_ready_deadline_runs_from_the_launch_through_every_step, the_ready_to_start_deadline_runs_from_the_ready_and_a_start_is_never_resent, a_vmm_that_exits_or_sends_anything_but_its_event_ends_the_launch, a_status_with_which_the_guest_ended_the_clone_s_vm_attributes_its_failure, a_failure_is_recorded_before_its_teardown_and_again_once_the_teardown_ended, a_launch_that_cannot_be_ended_keeps_its_records_and_its_lease_until_a_reattach_ends_it, a_caller_fails_a_ready_or_started_clone_with_its_own_evidence_as_the_sequence_fails_one, a_failure_that_cannot_be_recorded_before_its_teardown_keeps_its_launch_for_a_reattach, a_diagnosis_too_long_for_a_record_keeps_its_ends_and_its_evidence_through_a_reattach, a_clone_with_an_export_gets_its_mapping_table_once_ready_and_its_start_once_it_applied_it, a_partial_or_failed_mapping_table_ends_the_launch_and_its_sandbox_never_starts

Size

Measured against feature/nvx-refactor 385192f3, the base of the head dbbd8740 (the same numbers as against 5b3fab2c, where #1499 merged: git diff --numstat is identical):

• Core lines: 14 changed, 0 new, each a line that loses a deleted item: 5 imports and re-exports (platform/linux/mod.rs 1, platform/windows/mod.rs 2, store/regular.rs 1, store/locked.rs 1), 2 imports (sandbox/plan.rs, seal/windows.rs), and 7 lines of supervisor/launch.rs that lose LaunchFailure's two fields and abandon_after's spawned. The counted files lose 127 lines of code.
• Counted files: 23, where the estimate says 2. Each only loses code, imports or references; none gains code. The 14 files that it only deletes don't count. The 23, all under nvx-rs/src/host/, fall in three groups:
  • 1 file holds the clone path's module declaration and exports, which the Scope names: template/mod.rs.
  • 19 lose crate-private code, or the imports and re-exports, that the deletion leaves unused, which CI's warning-denied builds refuse (see the table above); a few also lose doc references to the clone path. The estimate doesn't count this fallout of the compiler's audit, which nvx-rs slimming, phase 4.2: the old code is deleted, consumers first #1087 makes part of each deletion.
  • 3 change only rustdoc: store/names.rs and supervisor/vmm.rs linked deleted items, which cargo doc with warnings denied refuses, and template/store/leases.rs said that the deleted launch refuses a socket path that is too long. The rules don't count docs, so counting these three as docs leaves 20.

File	What it loses	Why
template/mod.rs	mod clone, its pub use, and the five bullets of its rustdoc on the clone path	The clone path's module list and exports (the Scope)
template/store.rs	the re-export of SOCKET_PATH_LIMIT	Unused import
template/store/leases.rs	rustdoc only: the deleted launch's refusal of long socket paths	Describes deleted code
platform/mod.rs	is_refused, and the two mentions of it in the rustdoc	Dead code
platform/other.rs	the link_count stub; its ReadyListener's rustdoc names a restore, not a clone's launch	Dead code; describes deleted code
platform/linux/mod.rs	link_count from its re-exports	Unused import
platform/linux/identity.rs	link_count	Dead code
platform/linux/endpoint.rs	the unverified ReadyListener::receive, whose rustdoc joins receive_verified's; the rustdoc of its listener names a restore, not a clone's launch	Dead code; describes deleted code
platform/windows/mod.rs	listen_ready and link_count from its re-exports	Unused imports
platform/windows/identity.rs	link_count	Dead code
platform/windows/endpoint.rs	listen_ready; the rustdoc of its listener names a restore, not a clone's launch	Dead code; describes deleted code
sandbox/distro.rs	DistroBinding::version; CheckedDistro::geometry's link to ClonePlan	Dead code; broken doc link
sandbox/scratch.rs	ScratchBinding::version; CheckedScratch::geometry's link to ClonePlan	Dead code; broken doc link
sandbox/plan.rs	SandboxPlan::dns_server, and the IpAddr and Ipv6Addr imports that only it used	Dead code
seal.rs	final_volume_path	Dead code
seal/windows.rs	its final_volume_path, and the VOLUME_NAME_GUID import that only it used	Dead code
snapshot/key.rs	SnapshotKey::ipv6_gateway	Dead code
store/locked.rs	reserved_socket, owned_entries, and the imports that only they used	Dead code
store/names.rs	rustdoc only: four file names' links to ClonePlan::launch and CloneFailure, with what the deleted launch wrote in those files	Broken doc links
store/regular.rs	is_refused from its re-export, and from its rustdoc	Unused import
supervisor/launch.rs	Starting::end_keeping_journal, LaunchFailure's spawned and unended, and abandon_after's spawned; two rustdoc mentions of a clone's launch as the caller	Dead code; describes deleted code
supervisor/mod.rs	the pub(crate) re-exports of launch_reporting and reattach_reporting; the "Clones" rustdoc's links to ClonePlan, the restore sequence, CloneFailure and reattach_clone	Unused imports; broken doc links
supervisor/vmm.rs	rustdoc only: Vmm::stop_unless_exited's link to reattach_clone	Broken doc link

BOOT_CONTRACT_VERSION and CONTROL_CONTRACT_REVISION don't change.

Left as is

• Linux's ReadyListener::receive_checked keeps its verify_original_peer flag, which only true reaches now that the unverified receive is gone: the compiler doesn't flag it, and removing it would refactor code that stays.
• Public items that only the clone path called stay public, for the slices that delete their modules or decide their fate: CheckedDistro::geometry and CheckedScratch::geometry; the sandbox store's paths and names of a clone's files, which its release and removal still clean up; and Vmm::stop_unless_exited.
• The template store's and the sandbox store's own docs still describe a clone's lease, launch and files in general terms; SL6.2a and SL6.1 delete them with their modules.

Not in this PR

Rewriting, refactoring or improving any clone-independent code that stays; re-homing clone records, planning or reattachment; a replacement clone API, compatibility aliases or migration readers; deleting the store identities or the host::template aliases (SL6.2a, SL6.1); and the module diagrams, which CI draws.

Validation

On the head, dbbd8740, rebased without conflicts onto feature/nvx-refactor 385192f3, which gained #1511, #1497, #1501, #1503 and #1523 since 5b3fab2c. git range-diff against 6065e736, which Copilot reviewed, and against 993f80a7 shows only changed context lines: the commit's patch is unchanged. #1523's connect_child_endpoint, beside the Linux restore-ready listener that this PR edits, calls check_original_peer with its new accept_unreaped flag, which the listener's receive_checked passes as false; it uses nothing that this PR deletes. Nothing else that the base gained uses a deleted item, and nothing else became unused: with Rust 1.95.0 and NVX_BUNDLE=skip, locally on Windows and on nvx-mshv-test in a temporary worktree:

Check	Windows	Linux
cargo fmt --all --check	passed	passed
Clippy -D warnings, the six feature sets below	passed	passed
RUSTDOCFLAGS=-D warnings cargo doc --locked --no-deps --all-features	passed	passed
python scripts/public_api.py (both snapshots)	passed	passed
python scripts/check_test_layout.py, python scripts/check_markdown_links.py	passed
The case-matrix check against 99d20220	passed
cargo test --locked --all-features --lib	passed: 1366 (16 ignored)	passed: 2208 (58 ignored)
cargo test --locked --lib --no-default-features		passed: 283
python scripts/check_test_changes.py --base origin/feature/nvx-refactor	the same 360 changes, 121 removed tests, 7 modified tests

CI run 43169117234 of dbbd8740: its first attempt passed every job but NVX microVM tests / Linux / MSHV / Shard 1 of 2, whose interrupt-map scenario failed with NVX-INTERRUPT-MAP-QUIET base=0xd0007000 device=virtio5 irq=23 count=0 (status 37). That is the flake of #1400, which #1410 fixed on dev but which feature/nvx-refactor doesn't hold yet: the same failure hit feature/nvx-refactor's own push run 42717994707 and three dev merge groups. The scenario runs OpenVMM directly, without nvx-rs, on cached guest artifacts and OpenVMM. The second attempt reran the failed job, which passed.

On 993f80a7, rebased onto feature/nvx-refactor 5b3fab2c once #1499 (SL5.2) merged. git range-diff shows the commit's patch unchanged. The one conflict, in host/template/mod.rs, came from SL3.8b (#1489), which deleted the read_attachments re-export beside the clone path's exports; the resolution drops both. Nothing that the base gained since the previous base, a2fadde7 (#1486, #1487, #1489, #1491, #1496, #1500 and #1508), uses an item that this PR deletes, and nothing else became unused: the six Clippy sets pass, warnings denied, on both platforms. With Rust 1.95.0 and NVX_BUNDLE=skip, locally on Windows and on nvx-mshv-test (Azure Linux 3, kernel 6.18, linux-mshv, virtual machine), in a temporary worktree:

Check	Windows	Linux
cargo fmt --all --check	passed	passed
Clippy -D warnings, the six feature sets below	passed	passed
RUSTDOCFLAGS=-D warnings cargo doc --locked --no-deps --all-features	passed	passed
python scripts/public_api.py (both snapshots)	passed	passed
python scripts/check_test_layout.py, python scripts/check_markdown_links.py	passed	layout passed
cargo +1.89 check --locked --all-targets --all-features (MSRV)		passed
python3 scripts/nvx.py check-guest-binaries --toolchain 1.95.0		passed
cargo test --locked --all-features --no-fail-fast	passed: lib 1366 (16 ignored), cli 110, every other target, doc tests 11	2 runs: the second passed, lib 2207 (58 ignored), cli 119, every other target, doc tests 31; the first failed one test, cli's one_shot::one_shot_runs_exit_with_the_workload_or_openvmm_status (below)
cargo test --locked --no-fail-fast	passed: lib 1107 (10 ignored), every other target	4 runs: 3 passed, lib 1083 (10 ignored), every other target; the first failed one test, supervisor's vmms_inherit_only_their_streams_and_allowed_descriptors_while_others_spawn (below)
cargo test --locked --lib --no-default-features	passed: 283	passed: 283
python scripts/check_test_changes.py --base origin/feature/nvx-refactor	the same 360 changes as before the rebase, 121 removed tests

The two Linux failures each happened once, in code that this PR doesn't change, and didn't recur:

• tests/supervisor.rs's vmms_inherit_only_their_streams_and_allowed_descriptors_while_others_spawn failed in the first default-features run, as it had failed once per feature set in one run before the rebase. It then passed in 3 full runs and in 6 runs of --test supervisor, and at the base in 3 full runs. Its failures list sleep processes, which its other thread spawns with std::process, holding the test's pipes, which are close-on-exec. The test reads a sleeper's /proc/<pid>/fd as soon as Command::spawn returns. glibc's posix_spawn returns once the child releases its parent's memory in execve, which Linux does before it closes the close-on-exec descriptors, so for a moment the child still holds them all. A check on the host confirms it: right after posix_spawn returned, the child still held the parent's close-on-exec pipes in 2 of 2000 spawns on the idle host, and in 295 of 2000 with 8 busy loops. So the failure is a race of the test, which the base has too; SL6.1 deletes tests/supervisor.rs.
• tests/cli/one_shot.rs's one_shot_runs_exit_with_the_workload_or_openvmm_status failed in the first all-features run: its case run: Ubuntu exited 0, but without the fake OpenVMM's openvmm: booted the microVM line, which a one-shot run copies from the VM's console. It passed in the next full run, in 6 runs of --test cli -- one_shot::, and at the base in one full run. This PR deletes only items that nothing called, as the compiler shows, so nothing that nvx-rs run executes changes here.

Before the rebase, on 32ceca26, which differs from the head only in rustdoc and in the case matrix, the same platforms ran:

Check	Windows	Linux
cargo fmt --all --check	passed	passed
Clippy -D warnings: --all-targets --all-features, --lib, --lib --no-default-features, --lib --no-default-features --features serde, --lib --bins --features cli, --lib --bins --no-default-features --features testing	passed	passed
RUSTDOCFLAGS=-D warnings cargo doc --locked --no-deps --all-features	passed	passed
python scripts/public_api.py (both snapshots)	updated with --update, then passed	passed
python scripts/check_test_layout.py	passed	passed
cargo +1.89 check --locked --all-targets --all-features (MSRV)		passed
cargo check --locked --all-targets --all-features --target aarch64-apple-darwin		passed
cargo test --locked --all-features	passed: lib 1347 (15 ignored), cli 110, every other target, doc tests 11	passed, with --no-fail-fast: lib 2188 (57 ignored), where the base runs 2304 (59): the 118 clone tests that Linux builds leave; cli 119, every other target, doc tests 31 (base 32)
cargo test --locked	passed: lib 1105 (10 ignored), every other target	passed: lib 1081 (10 ignored), every other target, doc tests 11
cargo build --locked --lib --no-default-features, cargo test --locked --lib --no-default-features	passed: 283	passed: 283
cargo test --doc --all-features -- --list	13 doc tests, each at the line that its case-matrix row names	33 doc tests, each at the line that its case-matrix row names, host::template::store::Store at 473
python3 scripts/nvx.py check-guest-binaries --toolchain 1.95.0 (Clippy and tests of the guest feature for the guests' target)		passed
python scripts/check_markdown_links.py, python -m compileall -q scripts	passed
validate-nvx's Windows step: python -m unittest of its 22 modules, test_adversarial.py, test_hosts.py, and the nvx.py --help checks	1815 tests, 73 skipped, 1 error: a 10-second timeout of a generated script under Git's sh in MicrovmTests.test_host_loopback_script_probes_udp_on_proxy_and_general_ports, under load, which passed when rerun with the other 19 host-loopback tests (this change touches no script); test_adversarial.py 84 OK (11 skipped), test_hosts.py 4 OK, every --help exits 0

Windows' Clippy and --all-features tests ran on earlier versions of the commit, which differ from 32ceca26 only in comments and in Linux-only code. 6065e736, the head before the rebase, then changed only rustdoc and the case matrix, for the review below: RUSTDOCFLAGS=-D warnings cargo doc --all-features, cargo fmt --check and the doc-test list passed again on Windows.

A first Linux run found the dead-code check's only Linux-only finding, Linux's unverified ReadyListener::receive, which this PR deletes. In a later full run, the supervisor test above failed once per feature set; it passed in the full runs of the table, in 12 runs of --test supervisor and in 5 runs alone.

No microVM scenario ran: no runtime path changes. What nvx-rs run, sandbox and snapshot run doesn't use the clone path, and the edits to code that they use only remove what nothing calls. Left to CI: the bundled-artifact check and the build of the guest binaries, which this change doesn't reach, and the hypervisor jobs.

Changes to existing tests (tests-modified)

Besides the removals above, each change only drops or replaces what used a deleted item:

• host::platform::tests::a_bounded_read_refuses_a_regular_file_that_holds_more_than_its_bound and host::platform::tests::an_open_of_a_regular_file_refuses_a_link_and_a_directory: drop their assertions on is_refused, which leaves. The refusals' messages, and the missing file's NotFound, stay checked.
• host::store::tests::entries_that_are_links_or_not_regular_files_are_refused_as_the_platform_refuses_them: drops its assertion on platform::is_refused; the refusal's message, the platform's, stays checked.
• host::snapshot::key::tests::a_key_holds_what_its_capture_made: drops its checks of SnapshotKey::ipv6_gateway, which leaves (the clone path named its DNS server from it), with the spec without an IPv6 identity that only they used. The key of a template without a NIC still has no guest network.
• host::supervisor::tests::a_launch_whose_caller_cannot_record_its_failure_keeps_its_journal_for_recovery: drops its assertions on LaunchFailure::spawned and LaunchFailure::unended, which leave. It still checks the error's kind and message, the journal that remains for recovery, and the recovery. Its module imports launch_reporting from super::launch, now that supervisor/mod.rs doesn't re-export it.
• host::platform::windows::tests::a_restore_ready_client_that_closed_before_its_connection_was_accepted_is_read_to_its_end: binds its listener with ReadyListener::bind at a fresh pipe that control_endpoint draws, as a restore binds one at the pipe that its VM directory draws, in place of the deleted listen_ready, which drew a pipe of its own and bound it the same way. Same cases, same assertions.
• host::platform::linux::tests::a_restore_ready_client_that_closed_before_its_connection_was_accepted_is_read_to_its_end: receives through receive_verified, the receive that host::restore uses, in place of the deleted unverified receive. Same cases, same assertions. Its client is the test process itself, which runs throughout, so the check of the original peer passes, through SO_PEERPIDFD, which host::restore already requires (Linux 6.5 or a backport).
• host::template::store::tests: its imports lose the SNAPSHOT_ARTIFACTS re-export, and impl Store loses publish_spec_for_tests, which only the clone tests used.

[github-actions]

This pull request changes existing tests

It modifies or removes 360 existing test asset(s), listed below. Review each with care: a change to a test can hide a regression that the test caught. See doc/contribute.md#changes-to-existing-tests.

Test code

Change	What	Before	After
modified imports	the imports of host::template::store::tests	nvx-rs/src/host/template/store/tests.rs:5	nvx-rs/src/host/template/store/tests.rs:5
modified test	fn a_restore_ready_client_that_closed_before_its_connection_was_accepted_is_read_to_its_end in host::platform::linux::tests	nvx-rs/src/host/platform/linux/tests.rs:385	nvx-rs/src/host/platform/linux/tests.rs:385
modified test	fn a_bounded_read_refuses_a_regular_file_that_holds_more_than_its_bound in host::platform::tests	nvx-rs/src/host/platform/tests.rs:18	nvx-rs/src/host/platform/tests.rs:18
modified test	fn an_open_of_a_regular_file_refuses_a_link_and_a_directory in host::platform::tests	nvx-rs/src/host/platform/tests.rs:40	nvx-rs/src/host/platform/tests.rs:38
modified test	fn a_restore_ready_client_that_closed_before_its_connection_was_accepted_is_read_to_its_end in host::platform::windows::tests	nvx-rs/src/host/platform/windows/tests.rs:119	nvx-rs/src/host/platform/windows/tests.rs:119
modified test	fn a_key_holds_what_its_capture_made in host::snapshot::key::tests	nvx-rs/src/host/snapshot/key/tests.rs:412	nvx-rs/src/host/snapshot/key/tests.rs:412
modified test	fn entries_that_are_links_or_not_regular_files_are_refused_as_the_platform_refuses_them in host::store::tests	nvx-rs/src/host/store/tests.rs:416	nvx-rs/src/host/store/tests.rs:416
modified test	fn a_launch_whose_caller_cannot_record_its_failure_keeps_its_journal_for_recovery in host::supervisor::tests	nvx-rs/src/host/supervisor/tests.rs:590	nvx-rs/src/host/supervisor/tests.rs:591
removed attributes	the inner attributes of host::template::clone::failure::tests	nvx-rs/src/host/template/clone/failure/tests.rs:1
removed attributes	the inner attributes of host::template::clone::launch::tests	nvx-rs/src/host/template/clone/launch/tests.rs:1
removed attributes	the inner attributes of host::template::clone::records::tests	nvx-rs/src/host/template/clone/records/tests.rs:1
removed attributes	the inner attributes of host::template::clone::tests	nvx-rs/src/host/template/clone/tests.rs:1
removed attributes	the inner attributes of host::template::clone::tests::launch	nvx-rs/src/host/template/clone/tests/launch.rs:1
removed attributes	the inner attributes of host::template::clone::tests::launch::control_pipe	nvx-rs/src/host/template/clone/tests/launch.rs:672
removed attributes	the inner attributes of host::template::clone::tests::restore	nvx-rs/src/host/template/clone/tests/restore.rs:1
removed helper	const ALL in host::template::clone::failure::tests	nvx-rs/src/host/template/clone/failure/tests.rs:4
removed helper	impl < 's > Restoring < 's > in host::template::clone::launch::tests	nvx-rs/src/host/template/clone/launch/tests.rs:3
removed helper	fn into_starting in host::template::clone::launch::tests, impl < 's > Restoring < 's >``	nvx-rs/src/host/template/clone/launch/tests.rs:5
removed helper	fn private_dir in host::template::clone::records::tests	nvx-rs/src/host/template/clone/records/tests.rs:10
removed helper	fn failure in host::template::clone::records::tests	nvx-rs/src/host/template/clone/records/tests.rs:18
removed helper	const UUID in host::template::clone::tests	nvx-rs/src/host/template/clone/tests.rs:44
removed helper	const CONFIG in host::template::clone::tests	nvx-rs/src/host/template/clone/tests.rs:46
removed helper	const IMAGE_LEN in host::template::clone::tests	nvx-rs/src/host/template/clone/tests.rs:49
removed helper	const SCRATCH_LEN in host::template::clone::tests	nvx-rs/src/host/template/clone/tests.rs:51
removed helper	const PROCESSORS in host::template::clone::tests	nvx-rs/src/host/template/clone/tests.rs:53
removed helper	const MEMORY in host::template::clone::tests	nvx-rs/src/host/template/clone/tests.rs:55
removed helper	const MEMORY_CAPACITY in host::template::clone::tests	nvx-rs/src/host/template/clone/tests.rs:57
removed helper	const FIRST_PARTITION_BOUND in host::template::clone::tests	nvx-rs/src/host/template/clone/tests.rs:60
removed helper	const SECOND in host::template::clone::tests	nvx-rs/src/host/template/clone/tests.rs:62
removed helper	const NO_CONTENT in host::template::clone::tests	nvx-rs/src/host/template/clone/tests.rs:68
removed helper	const WRITE_ONLY in host::template::clone::tests	nvx-rs/src/host/template/clone/tests.rs:78
removed helper	const WRITE_ONLY in host::template::clone::tests	nvx-rs/src/host/template/clone/tests.rs:83
removed helper	fn open_write_only in host::template::clone::tests	nvx-rs/src/host/template/clone/tests.rs:87
removed helper	fn stage in host::template::clone::tests	nvx-rs/src/host/template/clone/tests.rs:98
removed helper	fn physical_block_size in host::template::clone::tests	nvx-rs/src/host/template/clone/tests.rs:108
removed helper	fn other_physical in host::template::clone::tests	nvx-rs/src/host/template/clone/tests.rs:127
removed helper	fn geometry in host::template::clone::tests	nvx-rs/src/host/template/clone/tests.rs:137
removed helper	fn set_geometries in host::template::clone::tests	nvx-rs/src/host/template/clone/tests.rs:147
removed helper	fn files in host::template::clone::tests	nvx-rs/src/host/template/clone/tests.rs:163
removed helper	fn set_processors in host::template::clone::tests	nvx-rs/src/host/template/clone/tests.rs:169
removed helper	fn shown in host::template::clone::tests	nvx-rs/src/host/template/clone/tests.rs:179
removed helper	fn layer in host::template::clone::tests	nvx-rs/src/host/template/clone/tests.rs:184
removed helper	fn gpt_layer in host::template::clone::tests	nvx-rs/src/host/template/clone/tests.rs:189
removed helper	fn tmpfs_request in host::template::clone::tests	nvx-rs/src/host/template/clone/tests.rs:197
removed helper	fn view in host::template::clone::tests	nvx-rs/src/host/template/clone/tests.rs:217
removed helper	fn scratch_request in host::template::clone::tests	nvx-rs/src/host/template/clone/tests.rs:227
removed helper	fn with_network in host::template::clone::tests	nvx-rs/src/host/template/clone/tests.rs:245
removed helper	fn network in host::template::clone::tests	nvx-rs/src/host/template/clone/tests.rs:253
removed helper	fn network_fixture in host::template::clone::tests	nvx-rs/src/host/template/clone/tests.rs:259
removed helper	fn attaching in host::template::clone::tests	nvx-rs/src/host/template/clone/tests.rs:274

... and 310 more, which the job's summary lists.

Relocated unchanged: 0; added: 0. Compared the merge base 385192f3708d with dbbd87407f7b.

[Copilot]

🟡 Changes recommended

The restore sequence omits required readiness and activation steps before commit, and the acceptance matrix still identifies the wrong PR as retiring the doctests.

2 open issues

• Point doctest retirement note to the template-store deletion · New
• Preserve readiness and activation checks before committing the restore · New

What changed in this PR

Removes the legacy store-based clone path as SL6.2b of NVX’s library-slimming workstream, following the runtime adapter’s removal in #1499. Template stores, identity types, and required aliases remain for subsequent deletion steps.

Changes:

• Deletes clone planning, launch, restore, records, reattachment, and their dedicated tests.
• Removes crate-private helpers used only by the deleted path and adjusts surviving tests.
• Updates documentation, public API snapshots, and doctest retirement tracking.

File	Description
nvx-rs/​src/​host/​template/​store/​tests.rs	Removes clone-only test helpers.
nvx-rs/​src/​host/​template/​store/​leases.rs	Removes documentation of deleted launch checks.
nvx-rs/​src/​host/​template/​store.rs	Removes the clone-only socket-limit re-export.
nvx-rs/​src/​host/​template/​mod.rs	Removes clone module, exports, and documentation.
nvx-rs/​src/​host/​template/​clone/​records/​tests.rs	Deletes clone-record tests.
nvx-rs/​src/​host/​template/​clone/​record.rs	Deletes clone activation-record construction.
nvx-rs/​src/​host/​template/​clone/​reattach.rs	Deletes store-based clone reattachment.
nvx-rs/​src/​host/​template/​clone/​launch/​tests.rs	Deletes the clone-launch test hook.
nvx-rs/​src/​host/​template/​clone/​launch.rs	Deletes legacy clone launch implementation.
nvx-rs/​src/​host/​template/​clone/​failure/​tests.rs	Deletes clone-failure classification tests.
nvx-rs/​src/​host/​template/​clone/​export.rs	Deletes clone-specific export checks.
nvx-rs/​src/​host/​supervisor/​vmm.rs	Removes clone-reattachment documentation references.
nvx-rs/​src/​host/​supervisor/​tests.rs	Adjusts imports and removes deleted-field assertions.
nvx-rs/​src/​host/​supervisor/​mod.rs	Updates clone documentation and removes private re-exports.
nvx-rs/​src/​host/​supervisor/​launch.rs	Removes clone-only failure fields and teardown helper.
nvx-rs/​src/​host/​store/​tests.rs	Removes an assertion using the deleted refusal helper.
nvx-rs/​src/​host/​store/​regular.rs	Removes the refusal-helper re-export and its documentation.
nvx-rs/​src/​host/​store/​names.rs	Removes documentation references to deleted clone writers.
nvx-rs/​src/​host/​store/​locked.rs	Removes clone-only socket and owned-entry accessors.
nvx-rs/​src/​host/​snapshot/​key/​tests.rs	Removes deleted gateway-accessor assertions.
nvx-rs/​src/​host/​snapshot/​key.rs	Removes the clone-only IPv6 gateway accessor.
nvx-rs/​src/​host/​seal/​windows/​tests.rs	Retires the volume-GUID path test.
nvx-rs/​src/​host/​seal/​windows.rs	Removes volume-GUID path support used only by clones.
nvx-rs/​src/​host/​seal.rs	Removes the private volume-path wrapper.
nvx-rs/​src/​host/​sandbox/​scratch.rs	Removes the version accessor and clone-plan documentation link.
nvx-rs/​src/​host/​sandbox/​plan.rs	Removes clone-only DNS lookup support.
nvx-rs/​src/​host/​sandbox/​distro.rs	Removes the version accessor and clone-plan documentation link.
nvx-rs/​src/​host/​platform/​windows/​tests.rs	Uses retained listener-binding APIs.
nvx-rs/​src/​host/​platform/​windows/​mod.rs	Removes unused helper re-exports.
nvx-rs/​src/​host/​platform/​windows/​identity.rs	Removes the hard-link count helper.
nvx-rs/​src/​host/​platform/​windows/​endpoint.rs	Removes the clone-only listener factory; updates documentation.
nvx-rs/​src/​host/​platform/​tests.rs	Removes deleted refusal-helper assertions.
nvx-rs/​src/​host/​platform/​other.rs	Removes the link-count stub; updates listener documentation.
nvx-rs/​src/​host/​platform/​mod.rs	Removes refusal classification helper and references.
nvx-rs/​src/​host/​platform/​linux/​tests.rs	Uses verified restore-ready reception.
nvx-rs/​src/​host/​platform/​linux/​mod.rs	Removes the link-count re-export.
nvx-rs/​src/​host/​platform/​linux/​identity.rs	Removes the hard-link count helper.
nvx-rs/​src/​host/​platform/​linux/​endpoint.rs	Removes unverified reception; updates listener documentation.
nvx-rs/​README.md	Removes legacy clone API descriptions.
nvx-rs/​public-api/​windows.txt	Removes deleted clone API entries.
nvx-rs/​public-api/​linux.txt	Removes deleted clone API entries.
doc/​acceptance-case-matrix.md	Retires the clone doctest and updates counts and locations.

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

The restore sequence omits binding the restore-ready endpoint and passing its path to OpenVMM, preventing the required event from being delivered.

1 open issue

• Bind the restore-ready endpoint before launching OpenVMM · New

2 resolved since last review

• Preserve readiness and activation checks before committing the restore
• Point doctest retirement note to the template-store deletion

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues remain.

No open issues 🎉

1 resolved since last review

• Bind the restore-ready endpoint before launching OpenVMM

_{Review effort: Balanced}